Regulations › Rest of world › Canada
PIPEDA
Personal Information Protection and Electronic Documents Act (Canada)
WhenIn effect since 1 January 2001
Who enforces itOffice of the Privacy Commissioner of Canada
Who it applies toPrivate-sector organizations handling personal information in commercial activity, outside provinces with substantially similar laws.
Tell the regulatorReport to the Commissioner as soon as feasible if a breach creates a real risk of significant…
DPO requiredEvery organization must designate an individual accountable for compliance
RegistrationNot addressed
Transfers abroadOrganization remains accountable and must use contracts or other means to ensure comparable pr…
Request deadlineRespond within 30 days, extendable by up to 30 more days
Maximum fineFines up to CAD 100,000 on indictment (CAD 10,000 summary) for knowing breach-reporting and li…
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Reach and lawful basis
Reach abroad
2
Applies to commercial activity with a real and substantial connection to Canada, and to interprovincial or international disclosures for consideration.s.4(1); s.30(1) · source ↗
Extraterritorial reach rests on case law (A.T. v. Globe24h.com, 2017 FC 114), not statute text.
Lawful basis
3
Consent is the default basis, with limited statutory exceptions.s.7; Sch. 1 cl. 4.3 · source ↗
Consent
1
Consent valid only if individuals understand nature, purpose and consequences; implied consent allowed, express generally for sensitive information.s.6.1; Sch. 1 cl. 4.3.6 · source ↗
Sensitive data
1
No special category; sensitivity drives the form of consent, generally express for sensitive information.Sch. 1 cl. 4.3.4, 4.3.6 · source ↗
Children
1
No statutory age; the OPC considers children under 13 unable to give meaningful consent.Sch. 1 cl. 4.3 (note) · source ↗
Age 13 position from OPC Guidelines for obtaining meaningful consent; not fetched this session.
People's rights
Rights
1
Access, correction, and withdrawal of consent; no statutory deletion, portability or automated-decision rights.Sch. 1 cl. 4.9, 4.9.5, 4.3.8 · source ↗
Bill C-27 (CPPA) died January 2025.
Request deadline
2
Respond within 30 days, extendable by up to 30 more days; no response is a deemed refusal.s.8(3)-(5) · source ↗
Marketing
1
Opt-out consent can suffice for non-sensitive secondary marketing uses; commercial electronic messages need opt-in under CASL.Sch. 1 cl. 4.3.7 · source ↗
CASL (S.C. 2010, c. 23) is separate legislation; clause 4.3.7 not fetched this session.
Governance
DPO required
3
Every organization must designate an individual accountable for compliance.Sch. 1 cl. 4.1 · source ↗
DPIA
–
Not addressedN/A · source ↗
OPC encourages PIAs as good practice; no statutory duty for private sector.
Records
1
No processing inventory; organizations must keep records of every breach of security safeguards.s.10.3(1) · source ↗
Breach records kept 24 months under Breach of Security Safeguards Regulations; not fetched.
Retention
1
Keep information only as long as needed for its purposes; destroy, erase or anonymize when no longer required.Sch. 1 cl. 4.5, 4.5.3 · source ↗
Breaches
Tell the regulator
1
Report to the Commissioner as soon as feasible if a breach creates a real risk of significant harm.s.10.1(1)-(2) · source ↗
Tell people
2
Notify individuals as soon as feasible where a breach creates a real risk of significant harm.s.10.1(3), (6) · source ↗
Transfers
Transfers abroad
1
Organization remains accountable and must use contracts or other means to ensure comparable protection by third-party processors.Sch. 1 cl. 4.1.3 · source ↗
Enforcement
Maximum fine
1
Fines up to CAD 100,000 on indictment (CAD 10,000 summary) for knowing breach-reporting and listed violations; no administrative fines.s.28 · source ↗
Criminal liability
1
Offenses for knowingly destroying requested information, failing to report breaches or keep records, or obstructing the Commissioner; fines only.s.28 · source ↗
Private action
1
After a Commissioner complaint, individuals may apply to the Federal Court for damages, including for humiliation.s.14, s.16 · source ↗
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws